Security news.
Today's cybersecurity landscape is marked by urgent patching mandates for actively exploited vulnerabilities and pervasive threats exploiting trusted channels. Critical flaws in Microsoft Entra ID and TrueConf Server require immediate attention, while new malware campaigns leverage Microsoft Teams and even Android car updaters for credential theft and botnet activity. Supply chain risks also persist with malicious Rust packages and exposed AWS keys.
Microsoft warns of max severity Entra ID flaw exploited in attacks
Microsoft has patched a maximum-severity vulnerability in its Entra ID identity and access management platform that has been actively exploited.
CISA adds Zimbra RCE to KEV Catalog, orders feds to patch
CISA has added a Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability (CVE-2026-73570) to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch. This follows a previous mandate to patch actively exploited TrueConf Server flaws (CVE-2026-72529, CVE-2026-72530).
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software
Check Point Research disclosed a technique allowing Microsoft Defender's legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations on Windows, potentially removing security software.
Hundreds of leaked AWS keys give full control over corporate accounts
Over 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 remain active and valid, potentially granting full control over corporate accounts.
New SynkLoader malware pushed in Microsoft Teams phishing campaign
A previously unknown malware family, SynkLoader, is being distributed via Microsoft Teams phishing campaigns to steal credentials using a fake lock screen.
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
A new malware family is infecting Android-based vehicle head unit firmware developed by DoFun, spreading through built-in updaters to enable ad fraud and create a proxy botnet.
New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets
The iAuthFlow V2 phishing toolkit can register attacker-controlled passkeys, allowing persistent access even after victims change passwords and revoke active sessions.
Rust Supply Chain Attack Linked to North Korean Hackers
North Korean hackers are suspected of pushing a poisoned version of the 'arrayref' Rust crate, adding a dependency to fetch a malicious payload from a remote server.